Rules card

How the signals work

Every sentence an interviewer can see, the rule that produces it, the number behind the rule, what it cannot tell you, and how it goes wrong. Thresholds on this page are read from the running code.

Rules version: rules@2026.10.2
Consent text: consent@2026.10.3
Thresholds: all hand-set; none tuned on candidate data yet
Decisions: none automated; a named reviewer records every decision

Three things that apply to every rule

Calibration first. Gaze, blink, voice and mouth thresholds are set against the candidate's own one-minute calibration (reading aloud, then thinking), not against a population. Absolute floors stop a quiet or still candidate from being flagged on a noisy baseline.
The gaze gate. Gaze and audio-visual observations are stored but only shown to the interviewer live if a non-gaze signal fired within the last 60 s. On their own they are too easy to misread.
Observations, not verdicts. Each one is a sentence with a timestamp and the raw numbers. The review page shows the recording at that moment. Nothing is scored, ranked or auto-rejected.

Browser

“Candidate clicked away from the interview window.”

FOCUS_LOST

Fires when: The interview tab lost focus for more than 3 s while the candidate was answering.
Cannot see: What the candidate switched to, or anything on a second monitor.
Known false positives: A notification popup or an accidental click also triggers it.
Suggested checks: Share screen

“Candidate pasted text into the interview window.”

PASTE

Fires when: Text was pasted into the interview window; only the length is recorded, never the content.
Cannot see: Where the text came from.
Known false positives: Pasting a link the interviewer sent also triggers it.
Suggested checks: Ask to rephrase

“Multiple monitors detected.”

MULTI_MONITOR

Fires when: The browser reports more than one display connected.
Cannot see: What is on the other display.
Known false positives: Many engineers simply have two monitors.
Suggested checks: Share screen

Boards

“A large block of code appeared in the editor at once.”

CODE_BURST

Fires when: 80 or more characters appeared in the code editor in one edit without a paste event.
Cannot see: Whether the code was typed from memory or from notes.
Known false positives: Editor auto-complete and snippet expansion also trigger it.
Suggested checks: Ask to rephrase · Reference-back

Devices

“Camera was briefly disabled.”

CAMERA_OFF

Fires when: The camera track was muted or removed for more than 2 s.
Cannot see: Why.
Known false positives: A genuine bandwidth drop looks the same; see NET_INCONSISTENT for the healthy-connection version.
Suggested checks: Head turn

“Virtual camera software detected.”

VIRTUAL_CAMERA

Fires when: The selected camera's name contains one of: obs virtual, obs-camera, manycam, snap camera, xsplit, camtwist, virtual camera.
Cannot see: A virtual camera with an innocuous name, or a hardware capture card.
Known false positives: Streamers and people using background-blur apps legitimately use these.
Suggested checks: Head turn · Hand occlusion

“Virtual audio device detected.”

VIRTUAL_AUDIO

Fires when: The selected microphone's name contains one of: vb-audio, vb-cable, cable output, cable input, blackhole, voicemeeter, virtual audio, loopback audio.
Cannot see: A relay with a plain device name.
Known false positives: Podcast and music setups route audio through these.
Suggested checks: Interrupt

Connection

“Camera went off while the candidate's connection was healthy.”

NET_INCONSISTENT

Fires when: The camera went off while the last connection sample (under 20 s old) showed loss ≤ 2% and RTT ≤ 250 ms.
Cannot see: Problems between the browser and the camera driver.
Known false positives: A laptop lid half-closing, or a USB camera disconnecting.
Suggested checks: Head turn · Share screen

Timing

“Unusual pause before answering.”

LATENCY_CONSTANT

Fires when: 3 consecutive answers each began 3 s–8 s after the question, within 500 ms of each other.
Cannot see: Whether the pause was thinking or listening to an earpiece.
Known false positives: A deliberate, disciplined candidate who always pauses before speaking.
Suggested checks: Interrupt · Ask to rephrase

Gaze (on device)

Computed in the candidate's browser from self-hosted face-landmark models. Only summary numbers per 500 ms window leave the device; windows with the face missing (< 70% visible) or too dark are ignored.

“Candidate's gaze pattern suggests reading.”

GAZE_READING

Fires when: Horizontal eye sweeps with a periodic return, sustained for 20 s, above the candidate's own calibration baseline and never under 3 saccades/s.
Cannot see: What is being read. A whiteboard, a second screen and a teleprompter look the same.
Known false positives: Reading the shared code editor, which is expected during a coding question.
Suggested checks: Close eyes · Ask to rephrase · Reference-back

“Candidate repeatedly looks below the camera before answering.”

GAZE_DOWN

Fires when: 3 answers that each began within 3 s of a fixation below the camera (gaze y < -0.35).
Cannot see: What is below the camera.
Known false positives: A notepad, a second laptop for legitimate notes, or a habit of looking down to think.
Suggested checks: Close eyes · Share screen

“Candidate looks to the same off-screen spot before answering.”

GAZE_OFFSCREEN

Fires when: 3 answers that each began after a fixation at the same far off-screen spot (|gaze x| > 0.55).
Cannot see: Who or what is there.
Known false positives: A window, a wall clock, or a family member in the room.
Suggested checks: Share screen · Close eyes

“Candidate's blink pattern is unusual for a sustained period.”

BLINK_ABNORMAL

Fires when: Blink rate below 4 or above 45 per minute for 60 s.
Cannot see: Whether a face is synthetic; this is a weak liveness hint only.
Known false positives: Dry eyes, contact lenses, concentration and some medications all change blink rate.
Suggested checks: Head turn · Hand occlusion

Audio-visual (on device)

“Voice continued while the candidate's lips were not moving.”

AV_MISMATCH

Fires when: Voice from the candidate's own microphone above 40% of their calibration level while jaw movement stayed under 30% of it, for 5 s, while the interviewer was not talking.
Cannot see: Whether the voice is a second person in the room or a replayed clip.
Known false positives: Speaker bleed on laptops without echo cancellation; a candidate who talks with little jaw movement. One alert per 2 minutes at most.
Suggested checks: Hand occlusion · Head turn · Interrupt

“Candidate's head has not moved at all for over a minute while speaking.”

HEAD_STATIC

Fires when: Head pose standard deviation under 1.5° for 90 s while the candidate was speaking in at least 30% of that time.
Cannot see: Distinguish a looped video from a very still person.
Known false positives: A candidate sitting rigidly because they are nervous.
Suggested checks: Head turn · Hand occlusion

The seven checks

Pressed by the interviewer, never automatic. Each one stamps a 10-second window on the recording with who pressed it; the candidate sees a one-line card for the ones that need an action.

Ask to rephrase

Say: "Can you say that last part again, but shorter?"

Reference-back

Connect this answer to something they said 10 minutes ago.

Interrupt

Cut in mid-sentence with a short follow-up.

Close eyes

Candidate will be asked to answer the next question with eyes closed.

Candidate sees: “For the next answer, please close your eyes while you speak.”

Share screen

Candidate will be asked to share their entire screen.

Candidate sees: “Please share your entire screen (all displays) for a moment.”

Head turn

Candidate will be asked to turn head fully left, then right.

Candidate sees: “Please slowly turn your head fully to the left, then fully to the right.”

Hand occlusion

Candidate will be asked to pass a hand across their face.

Candidate sees: “Please slowly pass your open hand in front of your face, left to right.”

Changes

The rules version is pinned on every evidence pack. When a threshold changes, the version changes, and interviews already recorded keep the version they were run under. Thresholds will be tuned on consented, de-identified research interviews only, and this page will say which.

Questions about a specific observation: open the review page, which shows the raw numbers next to the sentence, or read the security overview.